Protected Information - PROTECTED B

Definition

Particularly sensitive information related to non-national interest that a) may qualify for an exemption or exclusion under the Privacy Act or the Access to Information Act and b) whose unauthorized disclosure could reasonably be expected to cause serious injury to individuals, organizations or government.

Note: For guidance on the security categorization of Treasury Board Submissions, please visit the Privy Council Office site at: Security of Cabinet Confidences

Risks

Could result in:

Substantial distress to individuals due to the loss of privacy
Significant loss of competitive advantage to a Canadian company
Impeding the investigation of a serious crime
Impeding the development of major government policies

Examples (Not Limited to)

Documents containing more than one personal information data element:

Solicitor-client privilege
Performance evaluations and character references
Trade secrets
Third party business information provided in confidence where compromise could result in injury
Information pertaining to an investigation into possible violation of law/criminal information/histories
Medical, psychiatric or psychological reports
Threats and Risks Assessments (TRAs)
Business Continuity Plans (BCPs)

Security Screening Level	Reliability Status
Minimum Security Zone	Operations Zone. (Area monitored periodically and where access is limited to personnel who work there and to properly escorted visitors).
Marking	Top right-hand corner on first page.
Storage	Operations Zone. Hard copy: Locked cabinet or open shelving. Electronic copy: Store on network drive or on department approved and issued USB storage device in locked cabinet.
Preparation & Processing	Operations Zone or Security Zone as determined by a risk assessment.
Transport By Hand (To physically hand-carry protected or classified information from one person or place to another.)	Within restricted areas: PROTECTED B information must be transported discreetly. Document should be placed in an envelope or folder. Outside restricted areas: PROTECTED B information must be transported in a single sealed envelope with no security markings on the envelope, properly addressed. Commercial briefcase can replace envelope or be used for encrypted USB keys, tablets or laptops. Need-to-know principle.	The use of a commercial locking briefcase is required for all employees who need to transport PROTECTED B (paper or electronic) documents outside the building they work in.
Transmission (To send Protected or Classified information from one person/place to another by a third party.)	By Fax: Secure FAX required (Admiral Secure Products) By E-mail: PROTECTED B information can be sent within the department using MS Outlook or MS Lync. Ensure the recipient is an ESDC employee. Use Entrust to encrypt emails that include PROTECTED B information and that are being sent outside the departmental firewall. Email recipient should also use Entrust to decrypt received email. By Mail/ Courier: Internal mail: Double sealed envelopes with no security markings on outer envelope. External mail: First class mail. Requires a single sealed envelope for mailing in Canada. When warranted by TRA, include “To be opened only by …(name or position title)”.	FAX: Verify whether recipient has compatible secure product.
Declassification and Downgrading	Declassification is the decision, recorded in writing, of the originator of protected or classified information or an officer authorized by the Deputy Minister to remove the categorization level of the information. Downgrading is the decision, recorded in writing, of the originator of protected or classified information or an officer authorized by the Deputy Minister to lower the categorization level of the document.	Information is to be identified as protected or classified only for the period of time it requires safeguarding. After this period, the originator or the authorized officer is to have it declassified or downgraded (PDF, 398 KB), appropriately marked, and to inform all recipients of this action and its effective date. Whenever possible, originators are to provide, at the time the information is created or collected, a specific date or event at which time declassification or downgrading may occur. As a minimum, an automatic expiry date of 10 years should apply to the categorization of most information; however, the automatic expiry date would not apply to information classified as Top Secret nor to information identified as particularly sensitive PROTECTED B, (e.g. medical records) or extremely sensitive, PROTECTED C, (e.g. witness protection information).
Destruction	Hard copy: Commercially available cross-cut (Type II) shredder or RCMP recommended Type II shredder. Electronic copy: Destroy using approved methods. For further advice, please open an Online Service Request with the National Service Desk.	Follow the Retention and Disposal Schedule from Information Management.